CVE-2026-100193: Tutor LMS WordPress Plugin XSS Vulnerability

CVE-2026-100193 Overview

CVE-2026-100193 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Tutor LMS – eLearning and online course solution plugin for WordPress. The flaw affects all versions up to and including 4.1.0. The tab parameter on lesson pages is not sanitized before being written to the HTML sink. Unauthenticated attackers can craft a malicious URL that executes arbitrary JavaScript in the victim's browser when clicked. Exploitation depends on a specific precondition: the lesson's nav-items array must be empty, which bypasses the in_array() validation on the tab value.

Critical Impact
Successful exploitation allows session hijacking, credential theft, or administrative actions in the context of an authenticated WordPress user who clicks an attacker-controlled link.

Affected Products

Tutor LMS WordPress plugin — all versions up to and including 4.1.0
WordPress sites with lesson pages that have no post content and no attachments
WordPress sites where comments are disabled or viewers are unauthenticated

Discovery Timeline

2026-10-14 - CVE-2026-100193 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-100193

Vulnerability Analysis

The vulnerability resides in the Tutor LMS lesson rendering logic, specifically in classes/Lesson.php and the lesson content template at templates/learning-area/lesson/content.php. The tab request parameter is intended to be validated against a predefined list of navigation items using PHP's in_array() function. When the nav-items array is populated, invalid values are rejected. However, when the array is empty, the validation logic short-circuits and the raw, attacker-controlled tab value reaches the output sink unescaped. The attack produces a reflected payload that executes in the context of the WordPress site origin.

Root Cause

The root cause is insufficient input sanitization and output escaping on the tab parameter. The developer-supplied validation relies on list membership rather than character-level sanitization or context-aware output encoding. When the whitelist is empty, in_array() returns false for any input, but the control flow still allows the raw value to be echoed into the DOM. This is a classic case of implicit trust in upstream filtering combined with missing output escaping at the sink.

Attack Vector

An unauthenticated remote attacker crafts a URL to a vulnerable Tutor LMS lesson page with a malicious payload in the tab query parameter. The targeted lesson must have no post content, no attachments, and either disabled comments or an unauthenticated viewer to produce the empty nav-items array. The attacker then delivers the URL via phishing, forum posts, or social media. When a victim clicks the link, the payload executes in the browser under the WordPress site's origin, enabling session theft or forced administrative actions if the victim is an authenticated administrator. The vulnerability description and sink location are detailed in the Wordfence Vulnerability Analysis and the vulnerable source lines in WordPress Tutor Content Template #27 and WordPress Tutor Content Template #56.

Detection Methods for CVE-2026-100193

Indicators of Compromise

Requests to WordPress lesson URLs containing a tab parameter with HTML or JavaScript syntax such as <script, onerror=, or javascript:.
URL-encoded payloads targeting the tab parameter, for example %3Cscript%3E or %22%3E%3Csvg.
Referer headers pointing to external sites that deliver crafted links to Tutor LMS lesson pages.
Spikes in requests to lesson pages that have no post content or attachments.

Detection Strategies

Deploy WAF rules that inspect the tab query parameter on Tutor LMS lesson endpoints for XSS payload patterns.
Enable WordPress audit logging to capture full request URIs for all plugin endpoints, including query strings.
Correlate web server access logs with authenticated session activity to identify administrative actions following suspicious inbound links.

Monitoring Recommendations

Alert on any 200 OK responses to Tutor LMS lesson URLs whose tab parameter contains angle brackets, quotes, or encoded script tokens.
Monitor for anomalous outbound requests from administrator browsers, which may indicate exfiltration via injected scripts.
Track installed Tutor LMS plugin versions across WordPress estates and flag any instance at or below 4.1.0.

How to Mitigate CVE-2026-100193

Immediate Actions Required

Update the Tutor LMS plugin to the version released after 4.1.0 that includes the fix from WordPress Tutor Changeset 3730615.
Audit WordPress administrator and instructor accounts for unauthorized changes made during the exposure window.
Rotate administrator session cookies and enforce re-authentication after patching.

Patch Information

The vendor addressed the issue in a changeset to templates/learning-area/lesson/content.php that adds proper escaping on the tab parameter before output. Review the patch at WordPress Tutor Changeset 3730615 and upgrade all affected installations.

Workarounds

Deploy a web application firewall rule that blocks requests to Tutor LMS lesson URLs where the tab parameter contains HTML metacharacters or script tokens.
Ensure lesson pages contain content, attachments, or enabled comments so the nav-items array is non-empty, which triggers the existing in_array() validation.
Restrict access to lesson pages via authentication requirements where feasible, reducing the attack surface for unauthenticated requests.

bash

# Example ModSecurity rule to block XSS payloads in the 'tab' parameter
SecRule ARGS:tab "@rx (?i)(<script|onerror=|javascript:|<svg|<img)" \
    "id:1002601,phase:2,deny,status:403,msg:'Tutor LMS CVE-2026-100193 XSS attempt in tab parameter'"